Authentication dictionary attacks

These attacks are described in Security of the WEP Algorithm:

■ Passive attacks to decrypt traffic based on statistical analysis

■ Active attacks to inject new traffic from unauthorized mobile stations, based on known plain text

■ Active attacks to decrypt traffic, based on tricking the access point

■ Dictionary-building attacks, which, after analysis of traffic for about a day, allow real-time automated decryption of all traffic

Passive or Weak Initialization Vector Attack

An initialization vector (IV) is a 24-bit field that changes with each packet. Its purpose is to ensure that the same plain text data frame never generates the same WEP-encrypted data frame.

The IV is transmitted as plain text, and a user "sniffing" the WLAN can see the IV. Using the same IV over and over with the same WEP key, a hacker could capture the frames and derive information about the data in the frame and data about the network.

Static WEP keys have proven to be highly vulnerable to this type of attack. Therefore, WLANs should not use static WEP and should instead use the more advanced security features implementing 802.1x.

3-74 Securing Cisco Network Devices (SND) v2.0 © 2006 Cisco Systems, Inc.

Active "Bit Flipping" or Replay Attack

The wireless attacker flips (changes or forges) arbitrary bits in an encrypted message and correctly adjusts the cyclic redundancy check (CRC) (a value or checksum of the total number of bits sent) to appear as a valid message. Here are the eight steps in this type of attack:

Step 1 An attacker intercepts WEP encrypted packets.

Step 2 The attacker flips bits in a packet and recalculates the checksum with a valid cyclic redundancy check (CRC) value.

Step 3 The attacker transmits to the access point a bit-flipped frame with a known IV.

Step 4 The access point receives the modified frame and accepts the frame based on a valid CRC value.

Step 5 The access point forwards the frame to the Layer 3 router. The data in the frame is rejected because of a data error, and the router sends a retransmit response.

Step 6 The access point encrypts the response and sends it to the attacker.

Step 7 The attacker uses this response to derive the key or stream cipher data as a stream of bits rather than divided into blocks.

Step 8 The attacker gains access.

Authentication Dictionary Attacks

Most password-based authentication algorithms are susceptible to online (active) and offline (passive) dictionary attacks. During a dictionary attack, an attacker tries to guess a password and gain network access by using every "word" in a dictionary of common passwords or possible combinations of passwords. A dictionary attack relies on the fact that a password is often a common word, name, or concatenation of words or names with a minor modification such as a trailing digit or two. Longer passwords with a variety of characters (such as "4yosc 10cP!") offer the greatest protection against dictionary attacks.

During an online dictionary attack, an attacker tries to actively gain network access by trying possible combinations of passwords for a specific user. Online dictionary attacks can be prevented using lockout mechanisms available on RADIUS servers to lock the user out after a certain number of invalid login attempts. Online attacks also provide some evidence that a breach or compromise is being attempted, allowing you to take corrective measures.

An offline dictionary attack is carried out in two phases to uncover a password. In the first phase, the attacker captures the challenge and response messages between the user and the network. In the second phase, the attacker looks for a password match by computing a list of possible challenge response messages (using a precomputed dictionary, usually with the aid of a password-cracking program) and comparing these messages against the captured challenge and response message. The attacker uses known authentication protocol vulnerabilities to reduce the size of the user password dictionary. Enforcing a strong password policy and periodically requiring that users change their passwords can significantly reduce the potential for a successful offline attack using these tools. Unlike online attacks, offline attacks are not easily detected.

© 2006 Cisco Systems, Inc. Securing LAN and WLAN Devices 3-75

Continue reading here: EAP Deployment Comparison

Was this article helpful?

0 0